From b8235d7c1203ee2461c06bcb0e95e09532e09055 Mon Sep 17 00:00:00 2001 From: Jim Anderson Date: Tue, 28 Nov 2023 10:40:03 -0600 Subject: [PATCH 1/4] refactor aud claim logic - no functional changes refactor aud claim logic to make it more readable and easier to update. No functional changes. --- lib/src/main/java/com/auth0/jwt/JWTVerifier.java | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java index 6cec2026..089c382a 100644 --- a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java +++ b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java @@ -364,12 +364,17 @@ private boolean assertInstantIsLessThanOrEqualToNow(Instant claimVal, long leewa } private boolean assertValidAudienceClaim( - List audience, - List values, + List actualAudience, + List expectedAudience, boolean shouldContainAll ) { - return !(audience == null || (shouldContainAll && !audience.containsAll(values)) - || (!shouldContainAll && Collections.disjoint(audience, values))); + if (actualAudience == null) { + return false; + } else if (shouldContainAll) { + return actualAudience.containsAll(expectedAudience); + } else { + return !Collections.disjoint(actualAudience, expectedAudience); + } } private void assertPositive(long leeway) { From dd6215e25742bdcdf0047281e66a9b3b01525584 Mon Sep 17 00:00:00 2001 From: Jim Anderson Date: Tue, 28 Nov 2023 14:17:07 -0600 Subject: [PATCH 2/4] expected empty audience should throw InvalidClaimException --- lib/src/main/java/com/auth0/jwt/JWTVerifier.java | 12 +++++++++--- .../test/java/com/auth0/jwt/JWTVerifierTest.java | 15 +++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java index 089c382a..94339dbc 100644 --- a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java +++ b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java @@ -368,9 +368,15 @@ private boolean assertValidAudienceClaim( List expectedAudience, boolean shouldContainAll ) { - if (actualAudience == null) { - return false; - } else if (shouldContainAll) { + // normalize to lists if null + actualAudience = actualAudience == null ? Collections.emptyList() : actualAudience; + expectedAudience = expectedAudience == null ? Collections.emptyList() : expectedAudience; + + if (shouldContainAll) { + // containsAll([]) always returns true + if (expectedAudience.isEmpty() && !actualAudience.isEmpty()) { + return false; + } return actualAudience.containsAll(expectedAudience); } else { return !Collections.disjoint(actualAudience, expectedAudience); diff --git a/lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java b/lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java index 5a784b87..732d6365 100644 --- a/lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java +++ b/lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java @@ -310,6 +310,21 @@ public void shouldThrowWhenAudienceClaimIsNullWithAnAudience() { assertThat(e.getClaimValue().asArray(String.class), is(new String[] {null})); } + @Test + public void shouldThrowWhenExpectedEmptyList() { + IncorrectClaimException e = assertThrows(null, IncorrectClaimException.class, () -> { + // Token 'aud': 'wide audience' + String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJ3aWRlIGF1ZGllbmNlIn0.c9anq03XepcuEKWEVsPk9cck0sIIfrT6hHbBsCar49o"; + JWTVerifier.init(Algorithm.HMAC256("secret")) + .withAnyOfAudience(new String[0]) + .build() + .verify(token); + }); + assertThat(e.getMessage(), is("The Claim 'aud' value doesn't contain the required audience.")); + assertThat(e.getClaimName(), is(RegisteredClaims.AUDIENCE)); + assertThat(e.getClaimValue().asString(), is("wide audience")); + } + @Test public void shouldNotReplaceWhenMultipleChecksAreAdded() { JWTVerifier verifier = JWTVerifier.init(Algorithm.HMAC256("secret")) From 8fd8ca05cf06145c675606df931b43373bbfc6d1 Mon Sep 17 00:00:00 2001 From: Jim Anderson Date: Wed, 29 Nov 2023 10:06:53 -0600 Subject: [PATCH 3/4] null checks instead of mutating args --- lib/src/main/java/com/auth0/jwt/JWTVerifier.java | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java index 94339dbc..5c901fc8 100644 --- a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java +++ b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java @@ -368,9 +368,11 @@ private boolean assertValidAudienceClaim( List expectedAudience, boolean shouldContainAll ) { - // normalize to lists if null - actualAudience = actualAudience == null ? Collections.emptyList() : actualAudience; - expectedAudience = expectedAudience == null ? Collections.emptyList() : expectedAudience; + if (actualAudience == null && expectedAudience == null) { + return true; + } else if (actualAudience == null || expectedAudience == null) { + return false; + } if (shouldContainAll) { // containsAll([]) always returns true From 4a539e638db52d668fd78065a8cb3d45aa8e616a Mon Sep 17 00:00:00 2001 From: Jim Anderson Date: Wed, 29 Nov 2023 14:06:06 -0600 Subject: [PATCH 4/4] update audience validation logic --- lib/src/main/java/com/auth0/jwt/JWTVerifier.java | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java index 5c901fc8..bf180300 100644 --- a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java +++ b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java @@ -368,17 +368,11 @@ private boolean assertValidAudienceClaim( List expectedAudience, boolean shouldContainAll ) { - if (actualAudience == null && expectedAudience == null) { - return true; - } else if (actualAudience == null || expectedAudience == null) { + if (actualAudience == null || expectedAudience == null) { return false; } if (shouldContainAll) { - // containsAll([]) always returns true - if (expectedAudience.isEmpty() && !actualAudience.isEmpty()) { - return false; - } return actualAudience.containsAll(expectedAudience); } else { return !Collections.disjoint(actualAudience, expectedAudience);